Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Blockchain technology is on a collision course with EU privacy law

iapp.org

Post reply on HN
Print view View original

21–30 of 46 posts

Re: Blockchain technology is on a collision course with EU privacy law

#21

Post by GlitchMr »

Well, yeah, there is a rather straightforward solution - just don't store any personal information on a blockchain.

Is it practical? Sometimes yes. Some usecases won't be able to do that, and this is fine, they should just consider technologies other than a blockchain. Or if they really want to have blockchain, perhaps consider storing personal information in an external database with references to its fields on a blockchain. Possibly with a salted hash stored in a blockchain, so that it's possible to verify whether a value was changed. A matching checksum or an empty value (meaning a value removed due to GDPR requirements) would be fine.

Edit: A removed comment suggested storing an encryption key in a database to decrypt data on a blockchain. This is another way of looking at it - essentially keep two parts, one on a blockchain, another outside of blockchain - and you need both to decode the data while the part outside of blockchain could be removed.

Re: Blockchain technology is on a collision course with EU privacy law

#22

Post by [deleted] »

GlitchMr wrote: post #21

Well, yeah, there is a rather straightforward solution - just don't store any personal information on a blockchain. Is it practical? Sometimes yes. Some usecases won't be able to do that, and this is fine, they should just consider technologies other than a blockchain. Or if they really want to have blockchain, perhaps consider storing personal information in an external database with references to its fields on a bl…

[deleted]

Re: Blockchain technology is on a collision course with EU privacy law

#23

Post by [deleted] »

wyldfire wrote: post #9
mamon wrote: post #5

There's a very naive assumption in the article that Blockchain being incompatible with GDPR issue can be resolved by altering GDPR. I think it is impossible: GDPR is specifically designed to prevent sensitive personal information from leaking and information about one's financial transactions is one of the most sensitive pieces of information there is. So, if GDPR versus Blockchain case ever reaches any EU court the…

Laws are mutable, in general blockchains aren't. It is the case that the law can be modified. > I think it is impossible Unless they create an exemption for technologies which effectively partition transaction details from identity details. Or they could require the use of masking/ambiguation features like Ring signatures, mixer/tumblers, etc.

[deleted]

Re: Blockchain technology is on a collision course with EU privacy law

#24

Post by professorTuring »

Definitely it was a good read, but let me just focus on the main point.

It is true that Blockchain technology has been thought as a replacement of a trusted third party like a notary or central register, but usually those are public registries: household ownerships, public offers... And those registries are usually exceptions or are treated in a different way (and usually they are explicitly regulated by each country). A few of them are even public, like the defaulters list in Spain.

Also, it is quite naive to think that an European citizen can erase "any personal data", that could be quite convenient to erase your fresh new mortgage or obligations. You are only allowed to ask for irrelevant information to be removed not for specific business related log even if they have your personal data in them.

Re: Blockchain technology is on a collision course with EU privacy law

#25

Post by GlitchMr »

dullgiulio wrote: post #6
emef wrote: post #3

If you put data that's considered personal into a public blockchain, or any decentralized system, who becomes the owner of that data? Was it the company/service that originally published it on the blockchain? or is every node required to treat it as their own GDPR-compliant data?

Not just a public blockchain, any blockchain. Say an employee leaves, they should have the right to have records removed. The internal Enterprise Blockchain doesn't allow that. But because of hype, every big company has to have some sort of blockchain somewhere, for no good reason. The EU will get a lot of bad publicity while actually doing something very reasonable.

Huh? If that was the case, it would go a bit too far, as it would make technologies like e-mail or git illegal to use internally, considering those are likely to have a real name of a person who sent an e-mail/committed.

Re: Blockchain technology is on a collision course with EU privacy law

#26

Post by amelius »

professorTuring wrote: post #24

Definitely it was a good read, but let me just focus on the main point. It is true that Blockchain technology has been thought as a replacement of a trusted third party like a notary or central register, but usually those are public registries: household ownerships, public offers... And those registries are usually exceptions or are treated in a different way (and usually they are explicitly regulated by each country…

> that could be quite convenient to erase your fresh new mortgage or obligations.

But in some cases it could happen that this data has to be erased.

Re: Blockchain technology is on a collision course with EU privacy law

#27

Post by GlitchMr »

professorTuring wrote: post #24

Definitely it was a good read, but let me just focus on the main point. It is true that Blockchain technology has been thought as a replacement of a trusted third party like a notary or central register, but usually those are public registries: household ownerships, public offers... And those registries are usually exceptions or are treated in a different way (and usually they are explicitly regulated by each country…

Even in case of mortgages, you need to be prepared for requests. At least where I live, it's legally allowed to remove all information about a loan once you paid the entire cost of it.

Re: Blockchain technology is on a collision course with EU privacy law

#28

Post by cjbprime »

antsykarbo wrote: post #15

Clickbaity headline. It's not the "blockchain technology" as a whole, but some specific use of it that can potentially violate the GDPR. You don't need a blockchain to violate the law: you can do it with paper or mysql or usb keys. Bottom line is: don't put your customers' personal data onto anything that you don't control. Nothing to see here.

I don't think it's clickbaity. There is a legitimate conflict in goals between this legislation and the increasingly popular use of public blockchains to store personal data.

You don't need a public blockchain to violate the law, but it's hard to have a public blockchain without violating this law, if you use that blockchain to store personal data.

Re: Blockchain technology is on a collision course with EU privacy law

#30

Post by Arnt »

professorTuring wrote: post #24

Definitely it was a good read, but let me just focus on the main point. It is true that Blockchain technology has been thought as a replacement of a trusted third party like a notary or central register, but usually those are public registries: household ownerships, public offers... And those registries are usually exceptions or are treated in a different way (and usually they are explicitly regulated by each country…

I don't see the problem.

The GDPR allows you to keep what you need. For a blockchain, verification is a need, provided that you need verification. You can easily argue that you need verification of the most recent 2, 4, 256, 131072 blocks. Some number. All of the blocks for which you have some vaguely reasonable business need to verify, rounded up a bit perhaps.

As for really old blocks, do you need those? Why? I realise you can't follow the blockchain all the way back and verify all the way back without them, but if you're a business (or any kind of organisation covered by the GDPR) why do you need to follow the blockchain all the way back?

Post reply on HN